⚡ Vanexa Agent

Your Sovereign AI — Controlled from Your Phone.

🔒 Vanexa Agent — not yet publicly released. The "Vanexa AI" app is live on the Play Store, but the Vanexa Agent feature is disabled in the current public app build while we finalize sovereign neural routing. Early access will be enabled soon.

Vanexa Agent is a sovereign, mobile-first autonomous AI system that turns your computer into an AI-powered workhorse — controlled entirely from an Android app. Give it a natural language instruction from your phone, and it will autonomously plan, code, execute terminal commands, manage files, search the web, build games, generate media, and much more — streaming real-time progress back to your phone.

📱 Companion App Required

Vanexa Agent is designed as a headless daemon. It runs silently on your computer and receives all commands, configurations, and approvals through the official Android companion app.

📥 Download "Vanexa AI" on Google Play Store

The companion app provides:

• 🎛️ Full agent configuration (AI provider, model, API key, autonomy mode)
• 📡 Real-time task monitoring with live streaming output
• 🛡️ Human-in-the-Loop approval for dangerous operations
• 🔑 BYOK (Bring Your Own Key) management for 9 AI providers
• 📂 Workspace path scoping (control which directories the agent can access)
• 🧠 Memory & privacy management (clear agent memory on-demand)
• 🛑 Kill switch — instantly abort any running task

🚀 Quick Start (30 Seconds)

Install globally via npm:

npm install -g @vanexalabs-ai/vanexa-agent

After installation, pair with your phone:

vanexa-agent pair

🏛️ Architecture Overview

Vanexa operates on a Sovereign Peer-to-Peer Architecture — powered by WebRTC:

┌──────────────────────┐                                   ┌───────────────────────┐
│  📱 ANDROID APP      │     ⚡ WebRTC DataChannel (P2P)    │  💻 CLI DAEMON        │
│  (Command Center)    │◄═══════════════════════════════════►│  (Your Computer)      │
│                      │      Direct Encrypted Tunnel       │                       │
│  • Task Input        │      No Server in the Middle       │  • AgentLoop (Brain)  │
│  • Live Monitoring   │                                    │  • 64+ Tools (Hands)  │
│  • Config Sync       │          ┌──────────────┐          │  • 4-Layer Sandbox    │
│  • Kill Switch       │          │ ☁️ Signaling  │          │  • Cortex Memory      │
│  • Approval UI       │          │ (5 sec only) │          │  • 10 LLM Providers   │
└──────────────────────┘          └──────────────┘          └───────────────────────┘

1. You type a task on your phone (e.g., "Build me a portfolio website")
2. A 5-second handshake establishes a direct encrypted tunnel between your phone and computer — then the signaling server disconnects. No middleman.
3. The AgentLoop on your computer plans the task, calls your chosen LLM, and autonomously executes tools in a Plan → Act → Observe → Reflect loop
4. You monitor every step in real-time on your phone, and approve or deny dangerous operations

💡 Zero-Server Data Path. After the initial handshake, all communication flows directly between your phone and computer via an encrypted WebRTC DataChannel. No server ever sees your tasks, API keys, or data.

🔧 What Can It Do?

The agent ships with 64+ native tools across 10 domains, plus a self-evolving tool engine:

| Domain | Capabilities | |--------|-------------| | Terminal | Execute commands, run background processes, maintain persistent shell sessions (stateful REPL) | | File System | Read, write, edit (surgical search/replace), multi-edit, search (regex grep), find (glob), list, move, delete | | Code Intelligence | Syntax verification, symbol listing, AST search, Ripgrep-powered code search, semantic codebase search | | Git | Full git operations with risk-mapped approval gates | | Web | Fetch URLs (with SSRF protection), DuckDuckGo + Google web search | | Desktop Automation | Browser automation (Puppeteer-like), desktop screenshots, clipboard read/write, UI vision inspection, open files/URLs | | Media Generation | Procedural SVG/audio generation, AI image/video generation (auto-routes to your provider's native API: Gemini Imagen, OpenAI DALL·E, Qwen Wanx — with Pollinations.ai as free fallback), PDF text extraction, image OCR/vision | | 3D & Game Engines | Blender 3D automation (socket bridge), Godot 4.x automation, HTML5 game builder (Three.js/Canvas 2D), 15+ game development tools (lore, quests, dialogue trees, shaders, VFX, audio, tilemaps, UI/HUD, economy balancing, and more) | | Cognitive | Task planning (TodoWrite), persistent memory, sub-agent orchestration (parallel worker swarm), deferred MCP tool discovery | | System | Archive creation (zip/tar), system spec checks, printer integration, adaptive tool forge (the agent can dynamically create and hot-reload its own new tools at runtime) |

🧠 Sovereign Memory System

The agent maintains four distinct memory layers, all stored 100% locally on your machine:

| Layer | Purpose | Persistence | |-------|---------|-------------| | Sliding Window | Current conversation context with asymmetric pruning | Per-session, saved to disk | | Fact Store | Explicit facts the agent deliberately memorizes about you and your projects | Permanent (JSON) | | Cortex Vector DB | Semantic long-term memory — the agent learns from past mistakes and recalls solutions via cosine similarity search | Permanent (SQLite) | | Tool Forge | Self-created tools that the agent writes and hot-reloads at runtime | Permanent (JS files) |

The Cortex system runs entirely on-device using a local neural embedding engine — no cloud API calls required.

🔑 BYOK (Bring Your Own Key)

Vanexa Agent uses your own API keys — no middleman, no data leaves your machine. Just plug in your key and go.

| Provider | Available Models | Vision | |----------|-----------------|:------:| | DeepSeek | deepseek-v4-flash, deepseek-v4-pro | ❌ | | OpenAI | gpt-5.6-sol, gpt-5.6-terra, gpt-5.6-luna, gpt-5.4-mini | ✅ | | Anthropic | claude-fable-5, claude-opus-4.8, claude-sonnet-5, claude-haiku-4.5 | ✅ | | Gemini | gemini-3.5-flash, gemini-3.1-pro, gemini-3.1-flash-lite | ✅ | | Qwen | qwen3.7-max, qwen3.7-plus, qwen3.6-flash | ❌ | | Moonshot (Kimi) | kimi-k3, kimi-k2.7-code, kimi-k2.6 | ❌ | | xAI (Grok) | grok-4.5, grok-latest | ❌ | | Alibaba (DashScope) | qwen3.7-max, qwen3.7-plus, deepseek-v4-flash, kimi-k2.7-code, and more | ❌ | | Ollama | Any locally installed model | ❌ |

Models listed are the code defaults. The companion app lets you select from a curated list of available models per provider, which may include newer models not listed here.

Configure your key in the Vanexa phone app under Agent → Settings → API Configuration.

🛡️ Security

• 4-Layer Sandbox: Tool availability checks → Path scoping → Command risk classification → SSRF protection
• 3 Autonomy Modes: Passive (ask everything) → Supervised (auto-safe, ask-dangerous) → Autonomous (full auto)
• Self-Preservation: The agent cannot read, modify, or delete its own source code
• Workspace Scoping: The phone app controls exactly which directories the agent can access
• Proprietary Source: Distributed as compiled V8 Bytecode (.jsc), not readable JavaScript

🖥️ CLI Commands

vanexa-agent pair       # Pair with your phone
vanexa-agent start      # Start the daemon (listens for phone commands)
vanexa-agent stop       # Stop the daemon
vanexa-agent restart    # Restart the daemon
vanexa-agent status     # Check if daemon is running
vanexa-agent config     # Configure API provider interactively
vanexa-agent chat       # Start interactive chat mode (no phone needed)
vanexa-agent run <task> # Run a single task from CLI
vanexa-agent exec <cmd> # Quick execute a terminal command
vanexa-agent update     # Update to the latest version

🔧 Manual Installation (Advanced)

If you already have Node.js v24+ installed:

npm install -g @vanexalabs-ai/vanexa-agent
vanexa-agent pair

🛠️ Troubleshooting

npx: command not found

Node.js is not installed. Install Node.js manually from nodejs.org.

EACCES: permission denied

On macOS/Linux, fix npm permissions:

sudo npm install -g @vanexalabs-ai/vanexa-agent

Or use the recommended approach:

mkdir ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
source ~/.bashrc
npm install -g @vanexalabs-ai/vanexa-agent

Windows: running scripts is disabled

Run PowerShell as Administrator and execute:

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

🗑️ Uninstall

npm uninstall -g @vanexalabs-ai/vanexa-agent

🛡️ Security & Privacy

Vanexa Agent is built with a sovereignty-first security model:

• True Peer-to-Peer. Your phone and computer communicate directly via an encrypted WebRTC DataChannel. No server sits in the data path — your commands, results, and credentials never transit through any third party.
• API keys never leave your machine. Your LLM API keys are stored locally in ~/.vanexa/config.json and are sent directly from your computer to your chosen AI provider.
• 5-Second Signaling, Then Gone. The cloud signaling server only facilitates the initial WebRTC handshake (~5 seconds). It sees zero task content — only connection metadata (ICE/SDP). After the handshake, it disconnects.
• BYOK (Bring Your Own Key). Vanexa does not provision, manage, or have access to your API keys. You control your own billing with your AI provider.
• Human-in-the-Loop. In Mode B (default), the agent requests explicit approval from your phone before executing any potentially destructive operation (e.g., rm, sudo, system-level changes).
• V8 Bytecode. The compiled bytecode (bundle.jsc) is a standard commercial IP protection measure. The full source logic is auditable via the bundled bundle.cjs fallback.

If you have security concerns or wish to report a vulnerability, please contact: [email protected] or [email protected]

📄 License

Business Source License 1.1 (BUSL-1.1) © Ikbal Fadilah

Your computer. Your keys. Your rules.